Privacy policy
Last updated 21 September 2026.
This explains what Stars Games does with personal data. It covers two different relationships, and which one you are in changes the answer — so it is worth being clear about them first.
Which of these are you?
If you run a game on Stars Games (an operator), we are the controller of your own account data: your name, email, company and billing records. This policy describes what we do with it.
If you play a game that somebody runs on Stars Games, the operator of that game is the controller of your data. They decide why it is collected and what happens to it. We are their processor: we hold and process it on their written instructions and for no purpose of our own. Ask them first — and if you cannot reach them, ask us and we will point you at them.
What we collect
From operators
- Account: name, email address, password (hashed, never readable by us).
- Billing: plan, subscription status and invoice history. Card details go directly to Stripe and never reach our servers.
- Usage: which console screens you visit and what you change, so we can support you and keep an audit trail of administrative actions.
- Technical: IP address, browser and timestamps in server and security logs.
From players, on behalf of an operator
- Account: username, email address, hashed password.
- Play: predictions, scores, entries, league membership and the in-game currency ledger.
- Optional, and only if the operator has switched it on: date of birth for age-gating, or self-exclusion status.
- Technical: IP address and timestamps, for security and abuse prevention.
We do not buy personal data, we do not sell it, and we do not use it to train machine-learning models.
Why we are allowed to hold it
| What | Why | Lawful basis |
|---|---|---|
| Operator account | To provide the service you asked for | Contract |
| Billing records | To take payment and to keep the records tax law requires | Contract; legal obligation |
| Security and audit logs | To keep the platform and its tenants safe | Legitimate interests |
| Service email | To tell you about billing, outages and changes that affect you | Contract |
| Marketing email | Only if you asked for it, and every message can unsubscribe | Consent |
| Player data | Held for the operator, on their instructions | The operator's, not ours |
Where it lives
Everything is hosted in the European Union, on servers we control. Each operator gets their own database — not a shared table with a tenant column, but a physically separate database. One operator's game cannot read another's, and one operator can be exported, backed up or restored without touching anybody else.
Who else processes it
We use as few third parties as we can, and each one does one job:
| Who | What for | Where |
|---|---|---|
| Stripe | Payments and subscriptions. They receive card details directly; we receive only the result. | EU / US |
| Mailgun | Sending service email — sign-in links, password resets, round notifications. | EU |
| Bunny.net | Content delivery and DNS for the application bundle. | EU / global edge |
| Sports data providers | Fixtures and results. They receive no personal data from us. | Varies |
Error monitoring and realtime messaging run on our own servers rather than a third-party service, so crash reports and live updates do not leave our infrastructure.
Where a processor handles data outside the UK or EEA, that transfer is covered by the UK International Data Transfer Addendum or the EU Standard Contractual Clauses.
How long we keep it
- Operator accounts: for as long as the account is open, then 90 days, then deleted.
- Billing records: six years, because UK tax law requires it.
- Player data: for as long as the operator's game exists. A cancelled game is archived rather than deleted, so that the operator can still export it; they can ask us to delete it at any point.
- Backups: rolling daily snapshots, each aged out within 30 days.
- Security logs: 90 days.
Your rights
Under the UK GDPR and the EU GDPR you can ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, and ask for it in a portable format. You can also withdraw consent where consent is what we relied on.
Email privacy@starsgames.co.uk. We answer within 30 days. There is no charge.
Operators can help themselves: a full export of your game — players, rounds and the complete ledger — is a button in your console, at any time, on any paid plan.
If you are unhappy with how we have handled a request you can complain to the UK Information Commissioner's Office at ico.org.uk, or to your own supervisory authority in the EU.
Cookies
This marketing site sets no cookies at all and carries no analytics or advertising tags. There is nothing here to consent to, which is why you have not been asked.
The application itself stores a sign-in token and your display preferences in your browser's local storage. Those are strictly necessary to keep you signed in and are not used to track you across sites.
An individual operator may add their own analytics or sponsor content to their game. That is their choice and their disclosure to make, and their privacy notice covers it.
Children
The platform is not directed at children under 13, and we do not knowingly collect their data. An operator whose audience includes children is responsible for meeting the rules that apply to them, and can switch on age-gating to enforce a minimum age.
If something goes wrong
If a breach is likely to risk people's rights we will report it to the relevant authority within 72 hours of becoming aware, and tell affected operators without undue delay so that they can tell their players.
Changes
We will post any change here and update the date at the top. If a change materially affects you we will email you first.
Contact
Stars Games
privacy@starsgames.co.uk